Systems with distributed computers have at least a first computer, or client computer, and a second computer, or server computer. The client and server computers are communicatively connected with each other through a network. Usually, there are many client computers for a single server computer. The client computer is usually operated by a human user. The user accesses a data processing application and/or a database at the server computer.
In the so-called “cloud computing” approach, service providers operate many server computers in a single facility, such as a data centre, or a server farm. The application is available for potentially millions of users as so-called software as a service (SaaS). SaaS can include to store data in databases or in file structures.
Further, the service providers employ server administrators. The server administrators are responsible for the hardware of the server computers (processor, memory etc.), as well as for installation, maintenance etc. of the software that runs on the server computers (operating systems, applications, databases etc.). There can be different administrator roles for different components: such as the hardware administrator, the network administrator, the operating system administrator, the application administrator, the database administrator and so on. The roles can be performed by the same person, or by different persons.
Looking at the data that is processed and stored, it is mandatory that the access to the data is provided exclusively to the user of the client computer, but not for the administrator. This requirement is even more severe if client and server computers belong to different legal entities (in a so-called public cloud approach). The data exclusivity also applies to different users of different client computers.
The administrators need access to the hardware, the operating system etc. but the administrators do not need to have access to the data indeed. However, looking at the technology, the administrators can have access to the data. For example, the hardware administrator could intercept data by reading data from a data storage component (e.g., a disk drive), or by applying simple copy operations that do not require skill for other components. Further, a network administrator could intercept the data traffic to and from the computers.
Administrators are usually persons who are trusted by the operators of the computers and—indirectly—by the users. However, the trust is based on personal behaviour of the administrators, professional obligations outlined in so-called “codes of conduct” or in other policies, non-disclosure agreements with the operators, legal consequences in case of breach etc. Once in a while, particular administrators misuse the trust and spread data to non-authorized persons, or even to the general public. Or, administrator interfaces could be used by unauthorized persons (e.g., hackers).
There is a need for technical measures that further restrict the access to the data even if administrators gain access to same part of the system.
An overview to various architectures for applications and encrypted databases is given in the following reference: Alex Biryukov et al. “Database Encryption” in “Encyclopedia of Cryptography and Security”, Jan. 1, 2011, Springer US, Boston, Mass.